We have encountered an issue reported by three different customers via CSS that the WSUS team would like to address.

Issue: Computers that have Office 2003 or components of Office 2003 installed fail to run a detection against a WSUS server that has the latest Office updates synced down. This prevents the computers from receiving any updates from the WSUS server.

Root Cause:A recent revision to the ‘Office 2003 Service Pack 1’ update has resulted in some WSUS 3.0 servers syncing that revision to enter an inconsistent state with respect to the update’s approvals. When computers with products related to Office 2003 talk to such a server, the web service is unable to process the approvals resulting in the detection failure.

Workaround:In order to reset the approvals to a consistent state on the WSUS server, follow these steps from the WSUS Administration Console1. Find the ‘Office 2003 Service Pack 1’ update in the updates list. This may involve changing the Approval and Status filters in the update UI (set the Status to “Any” and the Approval to “Declined” – if you don’t see it then set the Approval to “Any except Declined”2. Perform the following steps:a. First make sure the update is declined. i. If the update is not yet declined, right click on the update and decline it.b. Next, approve the update. i. Right click on the update and select the ‘Approve…’ option in the context menu. ii. In the ‘Approve Updates’ dialog that opens, just click ‘OK’. Dismiss the ‘Approval Progress’ dialog that appears.c. Next, decline the update. i. Right click on the update and select the ‘Approve…’ option in the context menu. ii. In the ‘Approve Updates’ dialog that opens, just click ‘OK’. Dismiss the ‘Approval Progress’ dialog that appears.

The computers that were failing detection will now successfully complete detection against the server and receive any applicable updates.

Note: If you have a hierarchy of WSUS servers, these steps must be performed on each server, starting with the top-level server. If one of the servers is a replica child, one must first change it to be autonomous, then perform the steps above, then change it back to being a replica. This can be done from the Options/Update Source and Proxy Server Dialog.

Along with this workaround, the WSUS team is working on a long term fix in order to address this issue permanently. The information above will be shared to all external customers via the WSUS blog as well as via a formal KB that is currently in the works (though this is not being communicated externally yet). Please, share the information along in your blog posts and newsgroups.